I could not resist responding to the #openssl thread...

daniel://'s posts Post Back to profile

daniel:// stenberg://

I could not resist responding to the #openssl thread on #lwn:

https://lwn.net/Articles/983380/

Like 25 July at 21:02 | Open on mastodon.social

13 comments

thomasmey

@bagder TIL: TLS ECH -
https://blog.cloudflare.com/encrypted-client-hello

25 July at 21:22 | Open on social.tchncs.de

DELETED

@bagder thanks 🙂 I think it's better for me to opt for this then: https://github.com/gentoo-mirror/gentoo/blob/43e5ca0d495bc0b6ee10ea626cf3a0318051640f/net-misc/curl/curl-8.9.0.ebuild#L41

25 July at 21:27 | Open on digitalcourage.social

daniel:// stenberg://

@duxsco yes; ngtcp2 is a better, more mature and better performing QUIC implementation

25 July at 21:30 | Open on mastodon.social

DELETED

@bagder Thanks 🙂 I upgraded to curl 8.9.0 and am testing out:

GENTOO_MIRRORS="https://distfiles.gentoo.org"
FETCHCOMMAND="curl --fail --silent --show-error --location --http3-only --proto '=https' --tlsv1.3 --retry 2 --connect-timeout 60 -o \"\${DISTDIR}/\${FILE}\" \"\${URI}\""
RESUMECOMMAND="${FETCHCOMMAND} --continue-at -"

... in my #Gentoo's /etc/portage/make.conf

25 July at 22:39 | Open on digitalcourage.social

kurtseifried (he/him)

@bagder argh, is there a chart of QUIC support? The Wikipedia page only covers TLS 1.3 and seems to assume everyone did QUIC:

“TLS 1.3 (2018) specified in RFC 8446 includes major optimizations and security improvements. QUIC (2021) specified in RFC 9000 and DTLS 1.3 (2022) specified in RFC 9147 builds on TLS 1.3. The publishing of TLS 1.3 and DTLS 1.3 obsoleted TLS 1.2 and DTLS 1.2.”

https://en.m.wikipedia.org/wiki/Comparison_of_TLS_implementations

25 July at 21:31 | Open on infosec.exchange

daniel:// stenberg://

@kurtseifried I can't find any as exhaustive comparisons for QUIC implementations as there are for TLS. I saw this new effort recently that is trying to provide something, but is still lacking: https://quic-explorer.net/

25 July at 21:35 | Open on mastodon.social

Joel Berger

@bagder@mastodon.social TIL about ECH! Cool thanks!

25 July at 21:59 | Open on cloudpirat.es

SpaceLifeForm

@bagder

Well said.

Is LibreSSL alive and functioning?

25 July at 22:09 | Open on infosec.exchange

daniel:// stenberg://

@SpaceLifeForm I'm not following that project very closely but for all I can tell it seems to!

25 July at 22:10 | Open on mastodon.social

Billy O'Neal

@bagder Amen

25 July at 22:35 | Open on infosec.exchange

Kornel

@bagder PHK said if he was the NSA and wanted to undermine encryption on the Internet, an easy way would be to contribute patches with misleading docs, obfuscated code, and deceptive/insecure defaults to create the OpenSSL's API.

https://youtu.be/fwcl17Q0bpk?t=1690

25 July at 23:41 | Open on mastodon.social

daniel:// stenberg://

@kornel I don't believe that is "easy" at all.

26 July at 8:24 | Open on mastodon.social

rsalz

I could not resist either :)

26 July at 2:17 | Open on ioc.exchange